CCNA Notes

200-301 Exam Prep

Progress0/67

0% complete

Practice TestsNew
1Networking Devices2Interfaces And Cables3OSI Model and TCP/IP Suite4Intro to the CLI5Ethernet LAN Switching - Part 16Ethernet LAN Switching - Part 27IPv4 Addressing - Part 18IPv4 Addressing - Part 29Switch Interfaces10The IPv4 Header11Routing Fundamentals - Part 111Static Routing - Part 212Life of a Packet13Subnetting - Part 114Subnetting - Part 215Subnetting (VLSM) - Part 316VLANs - Part 117VLANs - Part 218VLANs - Part 319DTP / VTP20Spanning Tree Protocol - Part 121Spanning Tree Protocol - Part 222Rapid Spanning Tree Protocol23Etherchannel24Dynamic Routing25RIP / EIGRP26OSPF - Part 127OSPF - Part 228OSPF - Part 329First Hop Redundancy Protocol30TCP and UDP31IPv6 - Part 132IPv6 - Part 233IPv6 - Part 334Standard Access Control List35Extended Access Control List36CDP and LLDP37NTP - Network Time Protocol38DNS - Domain Name System39DHCP - Dynamic Host Configuration Protocol40SNMP - Simple Network Management Protocol41SYSLOG42SSH - Secure Shell43FTP and TFTP44NAT (Static) - Part 145NAT (Dynamic) - Part 246QoS (Voice VLAN) - Part 147QoS (Quality of Service) - Part 248Security Fundamentals49Port Security50DHCP Snooping51Dynamic ARP Inspection52LAN Architectures53WAN Architectures54Virtualization and Cloud - Part 154Virtualization (Containers) - Part 254Virtualization (VRF) - Part 355Wireless Fundamentals56Wireless Architectures57Wireless Security58Wireless Configuration59Introduction to Network Automation60JSON, XML, and YAML61REST APIs62Software Defined Networking63Ansible, Puppet, and Chef67CCNA Complete Cheatsheet
/Port Security
Topic 494 min read

Port Security

/
Tip: Select text to highlight or pin your reading position

49. PORT SECURITY

INTRO TO PORT SECURITY

  • PORT SECURITY is a security feature of Cisco SWITCHES
  • It allows you to control WHICH SOURCE MAC ADDRESS(ES) are allowed to enter the SWITCHPORT
  • If an unauthorized SOURCE MAC ADDRESS enters the PORT, an ACTION will be TAKEN
    • The DEFAULT action is to place the INTERFACE in an “err-disabled” state

imageClick to enlarge

  • When you enable PORT SECURITY on an INTERFACE with the DEFAULT settings, one MAC ADDRESS is allowed
    • You can configure the ALLOWED MAC ADDRESS manually
    • If you DO NOT configure it manually, the SWITCH will allow the first SOURCE MAC ADDRESS that enters the INTERFACE
  • You can CHANGE the MAXIMUM number of MAC ADDRESSES allowed
  • A COMBINATION of manually configured MAC ADDRESSES and DYNAMICALLY LEARNED ADDRESSES is possible

imageClick to enlarge

WHY USE PORT SECURITY?

  • PORT SECURITY allows NETWORK admins to control which DEVICES are allowed to access the NETWORK
  • However, MAC ADDRESS SPOOFING is a simple task
    • It is easy to configure a DEVICE to send FRAMES with a different SOURCE MAC ADDRESS
  • Rather than manually specifying the MAC ADDRESSES allowed on each PORT, PORT SECURITY’S ability to limit the number of MAC ADDRESSES allowed on an INTERFACE is more useful
  • Think of the DHCP STARVATION ATTACK (DAY 48 LAB video)
    • The ATTACKER spoofed thousands of fake MAC ADDRESSES
    • The DHCP SERVER assigned IP ADDRESSES to these fake MAC ADDRESSES, exhausting the DHCP POOL
    • The SWITCH’S MAC ADDRESS table can also become full due to such an attack
  • Limiting the NUMBER of MAC ADDRESSES on an INTERFACE can protect against those attacks

ENABLING PORT SECURITY

imageClick to enlarge

show port-security interface

imageClick to enlarge

imageClick to enlarge

imageClick to enlarge

RE-ENABLING AN INTERFACE (MANUALLY)

imageClick to enlarge

RE-ENABLING AN INTERFACE (ERR-DISABLE RECOVERY)

imageClick to enlarge

imageClick to enlarge

VIOLATION MODES

  • There are THREE DIFFERENT VIOLATION MODES that determine what the SWITCH will do if an unauthorized FRAME enters an INTERFACE configured with PORT SECURITY

    • SHUTDOWN

      • Effectively shuts down the PORT by placing it in an ‘err-disabled` state
      • Generates a SYSLOG and / or SNMP message when the INTERFACE is ‘disabled’
      • The VIOLATION counter is set to 1 when the INTERFACE is ‘disabled’

    • RESTRICT

      • The SWITCH discards traffic from unauthorized MAC ADDRESSES
      • The INTERFACE is NOT disabled
      • Generates a SYSLOG and / or SNMP message each time an unauthorized MAC is detected
      • The VIOLATION counter is incremented by 1 for each unauthorized FRAME

    • PROTECT

      • The SWITCH discards traffic from unauthorized MAC ADDRESSES
      • The INTERFACE is NOT disabled
      • It does NOT generate a SYSLOG / SNMP message for unauthorized traffic
      • It does NOT increment the VIOLATION counter

VIOLATION MODE - RESTRICT

imageClick to enlarge

VIOLATION MODE - PROTECT

imageClick to enlarge

SECURE MAC ADDRESS AGING

imageClick to enlarge

  • By DEFAULT, SECURE MAC ADDRESSES will not ‘age out’ (Aging Time : 0 mins)

    • Can be configured with switchport port-security aging time *minutes*

  • The DEFAULT Aging Type is ABSOLUTE

    • ABSOLUTE
      • After the SECURE MAC ADDRESS is learned, the AGING TIMER starts and the MAC is removed after the TIMER expires, even if the SWITCH continues receiving FRAMES from that SOURCE MAC ADDRESS.
    • INACTIVITY
      • After the SECURE MAC ADDRESS is learned, the AGING TIMER starts but is RESET every time a FRAME from that SOURCE MAC ADDRESS is received on the INTERFACE
        • Aging type is configured with: switchport port-security aging type {absolute | inactivity}

  • Secure Static MAC AGING (address configured with switchport port-security mac-address x.x.x) is DISABLED by DEFAULT

imageClick to enlarge

STICKY SECURE MAC ADDRESSES

  • ‘STICKY’ SECURE MAC ADDRESS learning can be enabled with the following command:

    • SW(config-if)# switchport port-security mac-address sticky

  • When enabled, dynamically-learned SECURE MAC ADDRESSES will be added to the running configuration, like this:

    • switchport port-security mac-address sticky *mac-address*

  • The ‘STICKY’ SECURE MAC ADDRESSES will NEVER age out

    • You need to SAVE the running-config to startup-config to make them TRULY permanent (or else they will not be kept if the SWITCH restarts)

  • When you issue the switchport port-security mac-address sticky command, all current dynamically-learned secure MAC addresses will be converted to STICKY SECURE MAC ADDRESSES

  • If you issue the no switchport port-security mac-address sticky command, all current STICKY SECURE MAC ADDRESSES will be converted to regular dynamically-learned SECURE MAC ADDRESSES

imageClick to enlarge

MAC ADDRESS TABLE

  • SECURE MAC ADDRESSES will be added to the MAC ADDRESS TABLE like any other MAC ADDRESS
    • STICKY and STATIC SECURE MAC ADDRESSES will have a type of STATIC
    • Dynamically-Learned SECURE MAC ADDRESSES will have a type of DYNAMIC
    • You can view all SECURE MAC ADDRESSES with show mac address-table secure

imageClick to enlarge

COMMAND REVIEW

imageClick to enlarge

PreviousSecurity Fundamentals
NextDHCP Snooping